Getting Data In

How does the connection process work when querying a large number of WMI hosts for statistics (not eventlogs)

Splunk Employee
Splunk Employee

If have 100 desktops i want to collect a few statistics from.. say every 30s... does Splunk make 100 queries every 30s or is there some staggering going on?

Would there be a number of WMI queries that would create a problem for a Splunk server.

It should be noted, that i am not collecting EventLogs--specifically Network Utilization stats on the internal network.

Tags (2)

Splunk Employee
Splunk Employee

Each WMI query will open a dedicated connection to the WMI framework to the target machine, and that connection will persisted for the life of the process or the life of the comm object. At this point we don't recycle the connections and we have time scheduled to go back and optimize this further.

Given this, there are obvious limitations to how many connections can we keep opened and I can't give an exact number to how many, but it is into the hundreds and this will depend on the available resources in the target machine.

Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...